Differential fault analysis
An attack that induces errors during a cipher's computation and compares correct and faulty outputs to recover the key.
Differential fault analysis (DFA) exploits the fact that a cryptographic operation can return a wrong result when someone disturbs the hardware, for instance with voltage glitches, laser pulses or radiation. The attacker compares the correct and faulty ciphertexts. Since the fault only touches a small part of a known intermediate state, the difference can reveal key bits.
Two papers from 1997 made the technique famous. Biham and Shamir showed that DES could be broken with DFA. Boneh, DeMillo and Lipton showed that RSA implementations using CRT optimisation could leak the whole private key from a single faulty signature. The latter is known as the Bellcore attack, after the research lab where the work was done.
The lesson is that a provably sound protocol is not enough if the implementation can be coaxed into making mistakes. Defences such as redundant computation and error checking cost performance, which is why they tend to appear where they are really needed, like payment cards and security modules.